Avici commits to full user compensation as hackers move on to new victims

Avici, a Solana-based neobank, has said that it will refund every affected card balance in full after an August 28 breach drained user funds. The same run of exploits claimed the Ethereum lending protocol Ajna a day later.

The refund promise came in an August 28 post on X, where Avici said its card-issuing partner Rain had traced the problem to a flawed version of a Solana card contract. 

“All affected card balances will be refunded in full”

Avici wrote that the contract was used by the neobank, “and a small number of other programs” before being upgraded across the board.

It stated that 1,685 users who were affected by the exploit, which represents $500,859.22 in card balances, will have their respective balances refunded in full. 

How the attacker emptied the card program

DefiLlama’s hack database logs the Avici incident at $500,859, the same as the firm stated in its update. It also classified it as a withdrawal logic flaw in a Rust-based protocol. Initial reports put the range between $600,000 and more than $1 million.

The attacker reportedly called a function named SubmitSignatures on Avici’s authorization program, followed by AddCollateralAdmin on its collateral program, then WithdrawCollateralAsset to pull funds out. 

The attacking wallet ended up holding about 10,005 SOL, worth around $1.07 million at the time, along with around $11,600 in stablecoins.

Following the exploit, the AVICI token fell by about 39% in 24 hours to near $0.26, touching a new all-time low of around $0.2189. That left it down by over 96% from the peak of $7.61 that it hit in November 2025.

As of the time of writing, the token has seen a little recovery and is now trading around $0.3093, but it is still down by over 27.8% in the past 24 hours, per CoinMarketCap data.

Ajna becomes the next name on the list

On August 29, on-chain monitoring firm Defimon Alerts reported on X that Ajna lost about $775,000 to what it described as liquidation accounting manipulation on Ethereum, with the syrupUSDC pool alone accounting for $173,700. 

Defimon said it had flagged a prepared attack more than an hour before the first exploit transaction and warned the team in its Discord, but Ajna “failed to react.”

Ajna confirmed it was investigating “unusual movements” and urged users to withdraw all funds, repay loans, and stop interacting with the protocol. 

DefiLlama data shows Ajna’s total value locked at about $246,880, down 71.3% over the prior 30 days.

A costly year for audited protocols

A CoinGecko report titled “2026’s State of Crypto Security” documented over 245 incidents between January 2025 and July 2026, totaling $3.63 billion in losses. 

Of those, 147 hit audited protocols, accounting for 88.44% of all stolen capital, and most attacks exploited infrastructure, third-party services, governance, or human error rather than bugs inside the audit’s scope.

Coverage to absorb those losses is also on a decline, as active on-chain insurance reportedly fell to 20.2% of the market, from $163.2 million to $130.2 million. Also, five of nine on-chain insurance protocols reportedly went inactive or pivoted by August 2026.

The smartest crypto minds already read our newsletter. Want in? Join them.